EEM to send email when Interface goes down

Introduction about EEM:

Cisco IOS Embedded Event Manager (EEM) is a powerful and flexible subsystem that provides real-time network event detection and onboard automation. It gives you the ability to adapt the behavior of your network devices to align with your business needs.

Your business can benefit from the capabilities of IOS Embedded Event Manager without upgrading to a new version of Cisco IOS Software. It is available on a wide range of Cisco platforms.

IOS Embedded Event Manager supports more than 20 event detectors that are highly integrated with different Cisco IOS Software components to trigger actions in response to network events. Your business logic can be injected into network operations using IOS Embedded Event Manager policies. These policies are programmed using either simple command-line interface (CLi) or using a scripting language called Tool Command Language (Tcl).

Harnessing the significant intelligence within Cisco devices, IOS Embedded Event Manager helps enable creative solutions, including automated troubleshooting, fault detection, and device configuration.
Source: Cisco.com




Lets get to it:

I will create EEM applet called interface down, and then I will choose the pattern of which you will match a certain string of letters that will be showing in the syslog for example (interface up or interface down or OSPF neighbor aged out or anything you want to match against)
 R1#
 R1#event manager applet INTERFACE_DOWN
 R1 #event syslog pattern " Loopback123, changed state to up"
 R1 #action 1.0 cli command "enable"  \ \ optional
 R1#action 2.0 cli command "show ip interface br | in up"
  R1#action 3.0 mail server "mail.pbit.com" to "samer.rafid@pbit.com" from "net.admin@pbit.com"   subject "link is down" body "please check internet link"
R1#

then to see this in action, you can enable debugging for event manager to debug mail events
#debug event manager action mail

Apr 14 14:17:27: %HA_EM-6-LOG: INTERFACE_DOWN : DEBUG(smtp_lib) : smtp_write Date: Sun, 14 Apr 2019 14:17:27 +0300

Apr 14 14:17:27: %HA_EM-6-LOG: INTERFACE_DOWN : DEBUG(smtp_lib) : smtp_write Message-ID: <000A2019141727818@PBIT-VG2.PBIT.COM>

Apr 14 14:17:27: %HA_EM-6-LOG: INTERFACE_DOWN : DEBUG(smtp_lib) : smtp_write From: net.admin@pbit.com

Apr 14 14:17:27: %HA_EM-6-LOG: INTERFACE_DOWN : DEBUG(smtp_lib) : smtp_write To: samir.rafid@pbit.com

Apr 14 14:17:27: %HA_EM-6-LOG: INTERFACE_DOWN : DEBUG(smtp_lib) : smtp_write Subject: link is down

Apr 14 14:17:27: %HA_EM-6-LOG: INTERFACE_DOWN : DEBUG(smtp_lib) : smtp_write

Apr 14 14:17:27: %HA_EM-6-LOG: INTERFACE_DOWN : DEBUG(smtp_lib) : smtp_write please check internet link

Apr 14 14:17:27: %HA_EM-6-LOG: INTERFACE_DOWN : DEBUG(smtp_lib) : smtp_write .

Apr 14 14:17:27: %HA_EM-6-LOG: INTERFACE_DOWN : DEBUG(smtp_lib) : fh_smtp_chk_reply looking for {250}

Apr 14 14:17:28: %HA_EM-6-LOG: INTERFACE_DOWN : DEBUG(smtp_lib) : fh_smtp_read {250 2.6.0 <000A2019141727818@PBIT-VG2.PBIT.COM> [InternalId=14955076124730, Hostname=mail02.PBIT.com] 1526 bytes in 0.182, 8.147 KB/sec Queued mail for delivery

}

Apr 14 14:17:28: %HA_EM-6-LOG: INTERFACE_DOWN : DEBUG(smtp_lib) : smtp_write QUIT

Apr 14 14:17:28: %HA_EM-6-LOG: INTERFACE_DOWN : DEBUG(smtp_lib) : fh_smtp_chk_reply looking for {221}

Apr 14 14:17:28: %HA_EM-6-LOG: INTERFACE_DOWN : DEBUG(smtp_lib) : fh_smtp_read {250 2.1.5 Recipient OK

}

Apr 14 14:17:28: %HA_EM-6-LOG: INTERFACE_DOWN : DEBUG(smtp_lib) : smtp_write DATA

Apr 14 14:17:28: %HA_EM-6-LOG: INTERFACE_DOWN : DEBUG(smtp_lib) : fh_smtp_chk_reply looking for {354}

Apr 14 14:17:28: %HA_EM-6-LOG: INTERFACE_DOWN : DEBUG(smtp_lib) : fh_smtp_read {221 2.0.0 Service closing transmission channel

}

Apr 14 14:17:28: %HA_EM-6-LOG: INTERFACE_DOWN : DEBUG(smtp_lib) : fh_smtp_read {354 Start mail input; end with <CRLF>.<CRLF>

}

Apr 14 14:17:28: %HA_EM-6-LOG: INTERFACE_DOWN : DEBUG(smtp_lib) : smtp_write Date: Sun, 14 Apr 2019 14:17:28 +0300

Apr 14 14:17:28: %HA_EM-6-LOG: INTERFACE_DOWN : DEBUG(smtp_lib) : smtp_write Message-ID: <000B2019141728818@PBIT-VG2.PBIT.COM>

Apr 14 14:17:28: %HA_EM-6-LOG: INTERFACE_DOWN : DEBUG(smtp_lib) : smtp_write From: net.admin@pbit.com

Apr 14 14:17:28: %HA_EM-6-LOG: INTERFACE_DOWN : DEBUG(smtp_lib) : smtp_write To: samir.rafid@pbit.com

Apr 14 14:17:28: %HA_EM-6-LOG: INTERFACE_DOWN : DEBUG(smtp_lib) : smtp_write Subject: link is down

Apr 14 14:17:28: %HA_EM-6-LOG: INTERFACE_DOWN : DEBUG(smtp_lib) : smtp_write

Apr 14 14:17:28: %HA_EM-6-LOG: INTERFACE_DOWN : DEBUG(smtp_lib) : smtp_write please check internet link

Apr 14 14:17:28: %HA_EM-6-LOG: INTERFACE_DOWN : DEBUG(smtp_lib) : smtp_write .

Apr 14 14:17:28: %HA_EM-6-LOG: INTERFACE_DOWN : DEBUG(smtp_lib) : fh_smtp_chk_reply looking for {250}

Apr 14 14:17:29: %HA_EM-6-LOG: INTERFACE_DOWN : DEBUG(smtp_lib) : fh_smtp_read {250 2.6.0 <000B2019141728818@PBIT-VG2.PBIT.COM> [InternalId=14955076124731, Hostname=mail02.PBIT.com] 1526 bytes in 0.169, 8.800 KB/sec Queued mail for delivery

}

Apr 14 14:17:29: %HA_EM-6-LOG: INTERFACE_DOWN : DEBUG(smtp_lib) : smtp_write QUIT

Apr 14 14:17:29: %HA_EM-6-LOG: INTERFACE_DOWN : DEBUG(smtp_lib) : fh_smtp_chk_reply looking for {221}

Apr 14 14:17:29: %HA_EM-6-LOG: INTERFACE_DOWN : DEBUG(smtp_lib) : fh_smtp_read {221 2.0.0 Service closing transmission channel

Samer R. Saleem